CVE-2026-80707

HighCVSS 7.5/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

Zero the allocated buffer in j1939_session_fresh_new() to ensure it contains no residual data.

While there is a potential performance impact if users allocate maximum sized ETP buffers, most real-world use cases are not noticeably affected since the maximum known buffer size is typically around 65K.

[mkl: add Message-ID]

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 9d71dd0c70099914fcd063135da3c580865e924c, < 348818277a3646d5b9fa60c9d20c00dc4bc86832; >= 9d71dd0c70099914fcd063135da3c580865e924c, < f3e120a34b336079479fa10f706f0636eaa6e751; >= 9d71dd0c70099914fcd063135da3c580865e924c, < bbfa49d1e287de44994955b44d19281be3195b44; >= 9d71dd0c70099914fcd063135da3c580865e924c, < 194d67e92197eb820f4c2c6605d9721333b3eba0; >= 9d71dd0c70099914fcd063135da3c580865e924c, < 038bad8e16c2e28acf31f0b527a816fb23a57269; >= 9d71dd0c70099914fcd063135da3c580865e924c, < 8604a3b81b9d0ceaf04fee5f52e701f623a179f9; >= 9d71dd0c70099914fcd063135da3c580865e924c, < d5b3613c7d69d8dcb4dd6704f1f463198ce9f6cf; >= 9d71dd0c70099914fcd063135da3c580865e924c, < eb96c58907922546e415e545fe9a14ea63b02719
LinuxLinux5.4

References

Timeline

Published
Aug 28, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-80708In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipheCVE-2026-807097.8In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs ThereCVE-2026-80718.8The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used iCVE-2026-807107.8In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmt_buffer_size in dasd_CVE-2026-80711In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does CVE-2026-807128.4In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SET_FEATUCVE-2026-807138.4In the Linux kernel, the following vulnerability has been resolved: io_uring: preserve task restrictions across exec Per-task restrictionsCVE-2026-807149.8In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connectiCVE-2026-80715In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy CVE-2026-807167.8In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a liCVE-2026-807177.5In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation LCVE-2026-807187.8In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
CVE-2026-80707: High severity, CVSS 7.5 | Vulnix